Description
A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins HashiCorp Vault Plugin | unspecified – ≤ 354.vdb_858fd6b_f48 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.datapipe.jenkins.plugins:hashicorp-vault-plugin | < 355.v3b_38d767a_b_a_8 | 355.v3b_38d767a_b_a_8 | GHSA-vpf7-q2rx-26mh |
Advisories 1
- WID-SEC-2022-0852 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 12, 2023